What Data Should Your Employees Never Put Into AI Tools
Not all data carries the same risk when it goes into an AI tool. Some of it’s fine. Some of it isn’t. The problem is that most employees don’t know the difference, and most businesses haven’t told them.
Why This Question Matters
When someone on your team pastes information into Claude, ChatGPT, or any other AI tool, that data leaves your environment. Where it goes, how it’s handled, and whether it’s retained depends entirely on the terms of the account they’re using. On a personal consumer account, those terms are often broader than you’d want. On a properly configured enterprise account, there are contractual protections in place. The difference matters, and it starts with understanding what kind of data you’re dealing with.
What Is Shadow AI and Why It’s Already Happening in Your Business
Data That’s Generally Off-Limits
Some categories of data should stay out of AI tools entirely, or require explicit review before they go in.
Protected health information is the clearest example. If your business operates in healthcare or works with healthcare clients, HIPAA governs how that data can be handled. A personal AI account doesn’t meet those requirements. Even a properly configured enterprise account requires a Business Associate Agreement before PHI can flow through it.
Client-specific data covered by confidentiality agreements is another category. If your client agreement says their information won’t be shared with third-party systems, an AI tool almost certainly qualifies as one. Before any client data goes into Claude, someone needs to check whether your agreement permits it.
Proprietary financial data — internal projections, deal terms, cap table information — is a third. It’s not necessarily regulated the way health data is, but it’s competitively sensitive. The question to ask is whether you’d be comfortable if that information surfaced somewhere you didn’t control.
Personally identifiable information deserves its own consideration. Names and email addresses on their own are usually low-risk. Combined with financial records, health history, or other identifying details, they’re not.
Data That’s Generally Fine
Internal documentation that doesn’t touch client data or regulated information is usually fine. Draft communications, process documentation, meeting notes without sensitive details, research on publicly available topics — these are the workflows where AI tools add the most value with the least risk.
The goal isn’t to lock your team out of useful functionality. It’s to make sure the high-sensitivity workflows have clear rules so the low-sensitivity ones can move fast without second-guessing.
The Gray Area
The hardest cases aren’t the obvious ones. They’re the in-between situations where an employee is working with data that’s partially sensitive — a client name attached to an internal project description, a financial summary that references a specific deal, a support case that includes personal details alongside technical information.
This is exactly why a data classification framework matters. Without one, every employee is making judgment calls on their own, with no shared standard and no way to know if they got it right.
How to Classify Your Business Data Before Rolling Out AI
At Fast Slow Motion, we use a traffic-light model: green means proceed without a second thought, red means never, yellow means stop and ask someone. The yellow category is where most of the gray-area data lives. The point of yellow isn’t to slow things down — it’s to route uncertain situations to someone who can make a call, rather than leaving the employee to guess.
How to Communicate This to Your Team
A policy document nobody reads doesn’t solve the problem. The communication that actually works is specific and concrete: here’s the category of data, here’s why it’s off-limits, here’s what to do instead.
A 30-minute team conversation that walks through real examples from your business — the kind of data your team actually works with — lands better than a generalized policy. It also gives people a chance to ask questions, which surfaces the gray-area situations you hadn’t thought to address.
How to Write an AI Usage Policy Your Team Will Actually Follow
The businesses that get this right aren’t the ones with the longest policy documents. They’re the ones whose teams actually know what the rules are.
Listen to the full podcast episode here.